2026-08-09_6e6e25c9e5b205a9625ba1785058d369_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_6e6e25c9e5b205a9625ba1785058d369_cobalt-strike_icedid_njrat_satacom
Size 282KB
Sample260809-hh8f2sseng
SHA256 8c98f40ba7df4f38550e07a1a1248e38037685414d0bb9d96c6c02699fcb2ce9
MD5 6e6e25c9e5b205a9625ba1785058d369
SHA1 89530a1a3ee9997984aac086804a60f6362a80c8
SHA512 e793d212e04738bbe2f1e547e33af642481c62fad48870a8abcf9cd89c0b79d7456ee5ebf16f908fb3377178539873112bede0c9c5eb1015647ee2acdbdbd7d0
SSDEEP 3072:vXIeyl99nGn+N9kfhyArYl7Ub8Oad0zp8KX5Mudbq4CCXM2aUoxgGtdnW6wAk:EPnGrfk9l7+8Ld+8sqxCvYDwJ
TLSH
T1A0546B59F3E514E9ED77D23CC9669907E67278121720DBEB03A04A653F236E09E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_6e6e25c9e5b205a9625ba1785058d369_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-08-09_6e6e25c9e5b205a9625ba1785058d369_cobalt-strike_icedid_njrat_satacom

.exe 282KB

2026-08-09_6e6e25c9e5b205a9625ba1785058d369_cobalt-strike_icedid_njrat_satacom

IMPHASH befb8e835d692cbb2eb9def4ed389e40
SHA256 8c98f40ba7df4f38550e07a1a1248e38037685414d0bb9d96c6c02699fcb2ce9
MD5 6e6e25c9e5b205a9625ba1785058d369
SHA1 89530a1a3ee9997984aac086804a60f6362a80c8
SHA512 e793d212e04738bbe2f1e547e33af642481c62fad48870a8abcf9cd89c0b79d7456ee5ebf16f908fb3377178539873112bede0c9c5eb1015647ee2acdbdbd7d0
SSDEEP 3072:vXIeyl99nGn+N9kfhyArYl7Ub8Oad0zp8KX5Mudbq4CCXM2aUoxgGtdnW6wAk:EPnGrfk9l7+8Ld+8sqxCvYDwJ
TLSH
T1A0546B59F3E514E9ED77D23CC9669907E67278121720DBEB03A04A653F236E09E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

IsWindowVisible TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetWindowPos SetTimer KillTimer GetSystemMetrics UpdateWindow GetForegroundWindow GetDC ReleaseDC GetCursorPos GetWindowLongPtrW GetClassNameW EnumWindows GetMessageW GetMonitorInfoW MonitorFromWindow MonitorFromPoint SystemParametersInfoW LoadCursorA SetWindowLongPtrW

gdi32

GetDeviceCaps GetStockObject

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

advapi32

EventUnregister EventSetInformation EventRegister EventWriteTransfer RegQueryValueExW RegOpenKeyExW RegCloseKey RegGetValueW

winmm

PlaySoundW

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData

shell32

SHGetFolderPathW ShellExecuteW

kernel32

VirtualProtect GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW CompareStringW SetStdHandle GetFileType HeapReAlloc HeapAlloc SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode LCMapStringW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetCurrentProcess GetStdHandle IsProcessorFeaturePresent DeleteCriticalSection HeapSize LeaveCriticalSection EnterCriticalSection GetFileAttributesW CloseHandle GetLastError SetLastError CreateMutexW Sleep GetTickCount64 GetModuleFileNameW GetModuleHandleW GetProcAddress MultiByteToWideChar WideCharToMultiByte CompareFileTime CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesExW GetFileSizeEx ReadFile SetFileAttributesW WriteFile TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW OutputDebugStringW GetProcessHeap HeapFree LoadLibraryExW LoadLibraryW FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW EncodePointer FlsFree WriteConsoleW InitializeCriticalSectionEx OutputDebugStringA RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue

Name

.text

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_6e6e25c9e5b205a9625ba1785058d369_cobalt-strike_icedid_njrat_satacom

user32

gdi32

ole32

advapi32

winmm

winhttp

shell32

kernel32

generic